You can do this globally for all data within splunk my using the [default] stanza within any props.conf, but not by index at least to my knowledge. [default] EXTRACT-<class> = [<regex>|<regex> in <src_field>] Example: [default] EXTRACT-foo = seattle-(?<system_type>\w{3})-\d{3} in host The host field now creates system_type field containing any three letters. If host contained seattle-dcs-001 system_type would contain dcs. Cheers I hope this helps ... View more

Hello @ektasiwani, You can use the rest api to return configurations in Splunk. This works well for Splunk defined or Modular input conf files. Using configs: | rest /services/configs/conf-authorize OR | rest /services/configs/conf-<file> Using properties endpoint: | rest /services/properties/authorize OR | rest /services/properties/<conf_file> Cheers, ... View more

Your JSON data is not well formatted as it looks like you have multiple events in a single json object. For json settings to work your data must look something like whats below foreach event: {"2015-08-02": { "downloads": 49, "updates": 4, "returns": 0, "net_downloads": 49, "promos": 0, "revenue": "54.98", "edu_downloads": 0, "gifts": 0, "gift_redemptions": 0, "date": "2015-08-02" } } The way you appear to be breaking data your event looks something like what below which is not proper json: "2015-08-02": { "downloads": 49, "updates": 4, "returns": 0, "net_downloads": 49, "promos": 0, "revenue": "54.98", "edu_downloads": 0, "gifts": 0, "gift_redemptions": 0, "date": "2015-08-02" } You could write a script to encapsulate each event in {}. If you just care about breaking the event correctly and not about it being in proper json you could use the following [kindofJSON] BREAK_ONLY_BEFORE="\d{4}-\d{2}-\d{2}": ... View more

To use post process searches you must use a transforming command before you reference searches will work. A transforming command is fields, tables, stats, etc. There is also limit of events which can be passed from the base to the reference search. index=os host=$host$ sourcetype="cpu" | fields _time host PercentSystemTime OR index=os host=$host$ sourcetype="cpu" | table _time host PercentSystemTime ... View more